9ed759befc
- server-deploy.md: state MySQL 8.0.13+ / MariaDB 10.2+ is required (expression defaults), not "5.7+" — an import against 5.7 is a day-1 ERROR 1064 blocker. - pilot-runbook: add the air-gapped Pi path and mark pip/fetch as build-machine only; stop the shipped doc from telling a Pi operator the bundle "does not exist". - install_offline.sh: instruct the camera probe before enable (mirrors setup_online). - setup_online.sh: chmod 600 device.env on read; README documents delete + rotate. - systemd unit: order After/Wants=time-sync.target so occurred_at is real wall time.
79 lines
4 KiB
Desktop File
79 lines
4 KiB
Desktop File
# move-detect edge daemon — systemd unit (Raspberry Pi 5, air-gapped/폐쇄망).
|
|
# Install: copy to /etc/systemd/system/, fill /etc/move-detect/edge.env, then
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now move-detect-edge
|
|
# The daemon tolerates the server being offline (events buffer in the local queue
|
|
# and flush on reconnect), so this unit only *wants* the network, not requires it.
|
|
|
|
[Unit]
|
|
Description=move-detect edge daemon (workplace-safety AI CCTV)
|
|
Documentation=file:/opt/move-detect/docs/pilot-runbook.md
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
# Order after clock sync so Event.occurred_at is real wall time, not the stale fake-hwclock time a
|
|
# Pi 5 (no RTC battery) boots with. Detector TIMERS are already immune (they run on a monotonic
|
|
# clock — see daemon.main), so this only affects timestamp accuracy; Wants (not Requires) so an
|
|
# air-gapped Pi with no reachable NTP still starts rather than hanging forever on time-sync.
|
|
Wants=time-sync.target
|
|
After=time-sync.target
|
|
# Never stop retrying. This MUST live in [Unit]: systemd's parser table knows
|
|
# Unit.StartLimitIntervalSec but only Service.StartLimitInterval (no "Sec"), so in
|
|
# [Service] it is an unknown key — silently ignored, leaving the default 5-starts/10s
|
|
# limit to defeat Restart=always below.
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
# Type=exec, not simple: with simple, systemd marks the start job done the instant fork()
|
|
# returns, so an exec-step failure (226/NAMESPACE, 216/GROUP, 217/USER, 203/EXEC) never
|
|
# reaches `systemctl enable --now` and the installer reports success over a dead daemon.
|
|
Type=exec
|
|
# Dedicated unprivileged account; must be in the groups that own the camera and
|
|
# the Hailo accelerator device nodes.
|
|
User=movedetect
|
|
Group=movedetect
|
|
SupplementaryGroups=video render plugdev
|
|
|
|
WorkingDirectory=/opt/move-detect
|
|
EnvironmentFile=/etc/move-detect/edge.env
|
|
# Run the package straight from source (no pip build step needed offline).
|
|
Environment=PYTHONPATH=/opt/move-detect/src
|
|
ExecStart=/opt/move-detect/venv/bin/python -m edge
|
|
|
|
# Unattended resilience: always restart; the loop also isolates per-frame and
|
|
# periodic-op exceptions internally so a single glitch never exits the process.
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# Writable state (offline queue sqlite lives here; keep QUEUE_DB pointed at it).
|
|
# systemd creates/owns /var/lib/move-detect for the service user.
|
|
StateDirectory=move-detect
|
|
StateDirectoryMode=0750
|
|
|
|
# Camera + accelerator device access. Once ANY DeviceAllow= is present, systemd denies every
|
|
# unlisted device node, so the CSI camera needs its nodes explicitly:
|
|
# char-video4linux USB UVC (/dev/video*) AND the CSI capture nodes
|
|
# char-media picamera2/libcamera opens /dev/media* to configure the CSI pipeline (Pi 5)
|
|
# char-dma_heap libcamera allocates capture buffers from the dma-heap on Pi 5
|
|
# Without char-media + char-dma_heap a Hailo Pi with a CSI camera is denied its own camera by this
|
|
# unit's policy. (OFF-HW: verify on the Pi — `journalctl` shows a libcamera EPERM/open failure.)
|
|
#
|
|
# NOTE: DeviceAllow= takes a device-node path OR a `char-<group>`/`block-<group>` name — NOT a
|
|
# directory. `/dev/dma_heap/` (a directory, trailing slash) is rejected at cgroup-realize time and
|
|
# silently dropped, leaving dma-heap DENIED under this deny-by-default policy. Use the char group
|
|
# (dma_heap appears in /proc/devices as a char device) so the whole /dev/dma_heap/* set is allowed.
|
|
DeviceAllow=/dev/hailo0 rw
|
|
DeviceAllow=char-video4linux rw
|
|
DeviceAllow=char-media rw
|
|
DeviceAllow=char-dma_heap rw
|
|
|
|
# Conservative hardening (loosen if it blocks device access on your image).
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
# Do NOT add ReadWritePaths=/var/lib/move-detect here. StateDirectory= above already emits
|
|
# a recursive read-write bind mount for that exact path, which outranks a ReadWritePaths=
|
|
# entry for the same path and drops it before any path is resolved. It is dead config: it
|
|
# can neither cause nor fix a state-dir problem.
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|